Don't know where to ask this question. My boss ask me to figure out usually how often to change the password? we are now developing a system requires high security.


I mean how many days before we force user to change password.

  • I worked at a place once where your password was your name +"1234". Like Paul1234 Those passwords were, of course, good forever. If you changed it, you actually annoyed coworkers who assumed that's what it was.
    – Paul
    Feb 13 '10 at 3:17
  • 2
    This question appears to be off-topic because it is fundamentally unanswerable. Nov 26 '14 at 16:39

Password length is not really so important; provided it's above a certain threshold, complexity is what matters most. You say you require high security so I'll second the recommendation to use something like an RSA fob in combination with a password.

For how often to change it, it depends really. Enforcing a password change is a level of protection against a compromised password that hasn't yet been used. Change too often and you'll only annoy the users (and increase the risk of them writing it down somewhere), change not often enough and you lose that protection. It could be argued that it's of dubious benefit.

More effective against brute force cracking attempts is some form of account lockout. Locking an account for even 30 seconds after 3 successive incorrect passwords will stop a brute force attack dead in its tracks.

Tell us more about the system. Is it internal or external? How sensitive is the data? These are factors which will determine if any recommendation is overkill (or underkill).

  • 1
    +1 for temporary lockout Feb 12 '10 at 23:25

See Password expiration policies for a good discussion.

My opinion is that in most situations, forcing password changes is more "security theater" than real security. Especially more frequently than 90 days.


From my experience, the more you ask a user to change its password, the more the password will end up being written on something and hidden beneath the keyboard, unless their job is actually keeping secret passwords, they have other things to keep think of than to remember a new password every week or month.

As a rule of the thumb, I'd say than more than every other month should do it.


Depends on who wants to break into your data.
If you have no useful data, then 8 characters and and 2 out of 4 (lower case, upper case, numbers, symbols) is probably good.
If you have mildly useful data, then 10 characters and 3 out of 4 is good-ish.
If you have sensitive data then at least 12 characters and all 4 out of 4. You might also consider getting RSA key fobs, or smart cards.

And for further reading on the current state of cracking passwords, read up Cracking Passwords in the Cloud.

As mentioned by someone else, password change time is very subjective. But in general 6 months is a good time frame. Go shorter or long if you feel you need to, you know much more about your network than and of us. Going too short will lead to sticky notes stuck to monitors with passwords. Too long make brute force attacks more feasible (though still very unlikely if you have a good lockout mechanism).

If you run Windows Server 2008 the default security settings are a very good starting point.

  • I mean how many days before we ask user to change password.
    – student
    Feb 12 '10 at 22:25
  • -1: password change has no effect on brute force attacks. Feb 14 '10 at 10:26
  • @Charles, if your system limits the number of passwords a brute force attack can try in a given time period, then changing the password anytime in that time period effectively starts the brute force attack over. You no longer have the birthday issue. Perhaps you should read up on security before marking someone down: en.wikipedia.org/wiki/Birthday_attack
    – Chris S
    Feb 14 '10 at 15:42
  • Oh yes, these armies of datacenters that are conducting offline attacks that allocate four months of their entire computing base to cracking a single password file. Every security professional has had intimately contact with such movie-plot operations... But seriously, this is misinformation, and should not be trotted out as a significant consideration. BTW, what relevance does your link have to brute force attacks? Cf. en.wikipedia.org/wiki/Brute_force_attack Feb 15 '10 at 8:47
  • @Charles, as long as we're throwing out the very remote possibility of MNO or Governmental Organizations trying to brute force a single password, why not just throw out password security all together? Companies rarely, if ever, get hacked by a password being broken. It's significantly easier to social engineer or exploit the latest security hole to gain access. What exactly are you proposing? That you should never change your password because other measures are always good enough in every possible situation?
    – Chris S
    Feb 15 '10 at 16:16

In order to obtain a serious security benefit from password changes you need to change them more frequently than they can be cracked. This is of course not practical in the real world, so you need to come up with some arbitrary figure dependent on your own assessment of risk. Just bear in mind that the more often you force people to change their passwords the weaker and more predictable those passwords are likely to be. After all, they need to be remembered and nobody wants to learn a new complex password on a regular basis. It's possible to have a policy that negates that human factor but all you're going to do then is piss off your users, who will start writing those passwords down, which of course defeats the purpose.

Not the answer you're looking for? Browse other questions tagged or ask your own question.